Module: Mongoid::Encryptable::ClassMethods

Defined in:
lib/mongoid/encryptable.rb

Instance Method Summary collapse

Instance Method Details

#embeds_encrypted?(path) ⇒ true | false

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Whether any model reachable through this model's embeds_one relations declares encryption.

embeds_many is not considered: libmongocrypt cannot express per-field encryption under array items, so those fields are never mapped.

Parameters:

  • path (Array<Class>) —

    The models the walk is already inside of. A model embedding itself terminates here.

Returns:

  • (true | false) —

    Whether an embedded model is encrypted.



71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/mongoid/encryptable.rb', line 71

def embeds_encrypted?(path)
  relations.each_value.any? do |relation|
    next false unless relation.is_a?(Association::Embedded::EmbedsOne)

    klass = relation.try_relation_class
    # An association target does not have to be a Mongoid document, and
    # the class it names does not have to exist.
    next false unless klass.respond_to?(:encrypted?)
    next false if path.include?(klass)

    klass.encrypted? || klass.embeds_encrypted?(path + [ klass ])
  end
end

#encrypt_with(options = {}) ⇒ Object

Set the encryption metadata for the model. Parameters set here will be used to encrypt the fields of the model, unless overridden on the field itself.

is deterministic or not.

Parameters:

  • options (Hash) (defaults to: {}) —

    The encryption metadata.

Options Hash (options):

  • :key_id (String) —

    The base64-encoded UUID of the key used to encrypt fields. Mutually exclusive with :key_name_field option.

  • :key_name_field (String) —

    The name of the field that contains the key alt name to use for encryption. Mutually exclusive with :key_id option.

  • :deterministic (true | false) —

    Whether the encryption



26
27
28
 
# File 'lib/mongoid/encryptable.rb', line 26

def encrypt_with(options = {})
  self.encrypt_metadata = options
end

#encrypted? ⇒ true | false

Whether the model is encrypted. It means that either the encrypt_with method was called on the model, or at least one of the fields is encrypted.

Returns:

  • (true | false) —

    Whether the model is encrypted.



35
36
37
 
# File 'lib/mongoid/encryptable.rb', line 35

def encrypted?
  !encrypt_metadata.empty? || fields.any? { |_, field| field.is_a?(Mongoid::Fields::Encrypted) }
end

#requires_encryption_schema? ⇒ true | false

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Whether an encryption schema has to be generated for this model.

True when the model declares encryption itself, and also when any model reachable through its embeds_one relations does. A model in the second group has no encrypted field of its own, but its collection still needs a schema, otherwise the embedded fields are written in plaintext.

The answer is memoized, since this runs on the persistence path. Declaring encryption on a model after it has already been persisted is not supported.

Returns:

  • (true | false) —

    Whether the model needs an encryption schema.



53
54
55
56
57
 
# File 'lib/mongoid/encryptable.rb', line 53

def requires_encryption_schema?
  return @requires_encryption_schema if defined?(@requires_encryption_schema)

  @requires_encryption_schema = encrypted? || embeds_encrypted?([ self ])
end

#set_key_id(key_id) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Override the key_id for the model.

This method is solely for testing purposes and should not be used in the application code. The schema_map is generated very early in the application lifecycle, and overriding the key_id after that will not have any effect.



93
94
95
 
# File 'lib/mongoid/encryptable.rb', line 93

def set_key_id(key_id)
  encrypt_metadata[:key_id] = key_id
end